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A blueprint for the creation of digitally 
resilient health systems in Europe 


The COVID-19 pandemic has exposed the lack of investment in and 
adoption of digital health solutions in Europe, leaving the potential of 
health data untapped and making health systems and organisations more 
vulnerable to crises. In this paper, DIGITALEUROPE recommends critical 
steps to improve the digital resilience of European health systems, 
including the creation of a European Health Data Space, harmonisation of 
health data processing rules, and increased share of digital spending in 
EU health funds. 


ow 4 Executive Summary 


The digital transformation of Europe’s health systems is a political decision. 


Health systems now produce as much as 30% of the world’s stored data,' but 
most of it remains siloed in hospitals and other specific organisations. The digital 
technology for moving to a paperless environment is there, but adoption of 
Electronic Health Records is just 3% in Europe.” Investment on software 
applications in healthcare is insufficient and trails that of many other sectors. 


It is now time to change tack. Digital technologies represent the silver lining of 
the COVID-19 crisis. They should characterise ambitious upgrades of European 
health systems and be at the core of a patient-centred, interoperable, trust-based 
Common European Health Data Space that will propel the EU towards new 
predictive and preventative models of care. 


DIGITALEUROPE recommends to: 


1. Create an EU Code of Conduct on the processing of health data for 
primary and secondary use containing practical guidelines helping health 
data actors across the data lifecycle. Industry must be a key player in it. 


2. Establish a central health data authority in each Member State to 
facilitate the secondary use of health data and design a pan-European 
infrastructure to enable cross-border health data use requests. 


l Huesch, M. and T. Mosher (2017). Using It or Losing It? The Case for Data Scientists Inside Health Care 
2 McKinsey (2019). Promoting an overdue digital transformation in healthcare 
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The development of Union law should be considered and carefully 
designed to encourage Member States to create such authorities which 
are compelled to share health data with one another. Union law will also 
be necessary to promote cross-border health data sharing and avoid the 
development of health data authorities with different rules, obligations, 
standards, or any other obstacle that can impede the sharing or exchange 
of cross-border health data. There should be no efforts to reopen the 
General Data Protection Regulation (GDPR) to do so. 


The Commission should complement these efforts with the creation of a 
single point of contact at EU level that would act only as a facilitator to 
assist, in cooperation with Member States’ health data authorities. 


3. Issue European Data Protection Board (EDPB) essential guidance 
on the GDPR in collaboration with industry. It is fundamental to bring 
harmonisation on the use of public interest, legitimate interest and 
consent as legal basis. It is also crucial to to clarify the compatibility of 
primary and secondary use of data as well as the interaction between the 
GDPR and local and national regulations affecting health data 
processing. 


4. Complete before 2024 the creation of profiles giving interoperability 
specifications for all baseline information domains contained in the 2019 
Commission Recommendation on a European Electronic Health Record 
exchange format.” 


5. Ringfence 8-10% of the EU4Health budget to realise the Common 
European Health Data Space and make digital health a spending priority 
in ReactEU, European Regional Development Fund (ERDF), Digital 
Europe Programme and Connecting Europe Facility 2.0 Digital. 


Enabling health data-processing in the EU 


80% of health data remains unstructured and untapped after it is created.* We 
urge the EU to make the most of the vast, untapped pool of health data that sit 
idle in health organisations across the continent. 


Now more than ever, Europe must double down on its ambition to create a 
Common European Health Data Space (EHDS) that has as its goal the flow of 
important health data and Electronic Health Records (EHRs) across the EU, and 
is inclusive and accessible to all health stakeholders, both public and private. 


3 Commission Recommendation (EU) 2019/243 of 6 February 2019 on a European Electronic Health Record exchange format 
4 Kong, Hyoun-Joong. (2019). Managing Unstructured Big Data in Healthcare System. Healthcare Informatics Research. 
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We need to: 


1. 


mm) 


Create an EU Code of Conduct (CoC) on the processing of genetic, 
biometric, or health data. The CoC should accelerate the access and 
processing of such data within the Member State in cooperation with all 
key public and private stakeholders, with the goal to have the possibility 
to process this data across all Member States. European cooperation to 
fight diseases and viruses, population health management at scale and 
support to safe cross-border travel are concrete examples of why we 
need a CoC. It must entail: 


Public interest as legal basis for circumstances in Article 9.2 of the 
GDPR. The Code should also give a common interpretation of 


what is considered “public interest” by national authorities across 
the EU. Unjustified, restrictive Member States’ interpretations of 
public interest are preventing hospitals from sharing life-saving 
data with relevant organisations. 


A relative anonymisation model that provides traceability back to 
the source records without representing a risk for subject 
identification. It would facilitate data sharing from institutions to 
researchers, between pharmaceutical companies (for example to 
limit the need for a placebo/standard-of-care arm in a clinical trial) 
as well as from pharmaceutical companies to government-funded 
research initiatives. Data Protection Authorities are adopting 
excessively strict interpretations of what constitutes anonymous or 
anonymised data. This hinders health data processing and makes 
very difficult for entities to agree on whether and how parties can 
use the data at issue. 


An opt-out model for secondary use of data in research fields with 
higher patient identification sensitivities. This model would suit 
areas like rare diseases, genomes and personalised medicine, 
with higher reidentification risks than normal and where complete 
de-identification may impact the successful research outcome. A 
robust ethical and security framework would build necessary 
patient trust in this model and guarantee that vital identifiable data 
for research progress is handled properly. It would entail patient 
rights to actively object to their data being processed. Consent in 
this model should be, if required, an additional “ethical” safeguard, 
rather than the main legal basis for processing. 


Very practical guidelines which can support practitioners along the 
healthcare value chain (including patients, physicians, healthcare 
managers, industry) facilitating a better, common understanding of 
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the access, control, use and sharing of data and unlocking its 
potential benefits, all while adopting appropriate risk management 
strategies. 


2. Establish a central health data authority in each Member State to 
facilitate the secondary use of health data and design a pan- 
European infrastructure to enable cross-border data use requests. 


The development of Union law should be considered and carefully 
designed to encourage Member States to create such authorities which 
are compelled to share data with one another. But there should be no 
efforts to reopen the GDPR to do so. 


All efforts should only take as a model Finland’s FinData and France’s 
Health Data Hub. Both examples used as legal basis the GDPR 
provisions of Article 9.2.i and 9.2.j, in “ensuring high standards of quality 
and safety of health care and of medicinal products or medical devices” 
and “necessary for [...] scientific [...] research”. 


Union law will also be necessary to promote cross-border data sharing 
and avoid the development of health data authorities with different rules, 
obligations, standards, or any other obstacle that can impede the sharing 
or exchange of cross-border health data. 


The Commission should complement these efforts with the creation of a 
single point of contact at EU level that would help to coordinate cross- 
border requests for the access to and the re-use of health data, and 
support the setting of interoperability standards. Such an authority would 
act only as a facilitator to assist and in cooperation with the Member 
States’ health data authorities. 


For all these initiatives to succeed, it is crucial that the Commission 
institutes a broad definition of what constitutes scientific research. In 
today’s Al and big data age, many commercial activities may qualify as 
scientific research. This is key if we want central health data authorities to 
plug health data into the Common European Health Data Space. 


3. Issue European Data Protection Board (EDPB) essential guidance 
on the GDPR in collaboration with industry. It is fundamental to bring 
harmonisation on the use of public interest, legitimate interest and 
consent as legal basis, and to clarify the compatibility of primary and 
secondary use of data as well as the interaction between the GDPR and 
local and national regulations affecting health data processing. 


Different Member States’ interpretation of the GDPR and additional, 
stricter national rules to process genetic, biometric and health data are 
seriously denting the applicability of the GDPR. We recommend that the 
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EDPB issue related guidance in order to encourage further harmonisation 
amongst national DPAs and their respective data protection frameworks. 


4. Fulfil the ambitions in the Commission Recommendation ona 
European Electronic Health Record exchange format. ° The Common 
European Data Space must ensure data systems are interoperable and 
citizens have control of their personal data at any time. The Commission 
must complete by 2022 the exchange of electronic patient summaries and 
ePrescriptions between various Member States. 


It should also not lose sight of the other baseline domains identified in the 
Recommendation. We need profiles providing specifications for 
interoperability also for laboratory results, medical imaging and reports, 
and hospital discharge reports. These information domains showed to be 
vital in the fight against COVID-19 across Europe. The Commission 
should complete these profiles before 2024 and support their practical 
implementation to meet clinical needs. 


Existing Fast Health Resource Interoperability (FHIR) specifications 
should be used as reference to enable data exchanges between health 
applications. They are consistent, easy-to-implement information models 
used by all major cloud providers. They also build on similar 
specifications in related ICT health solutions. 


Capacity building for resilient health systems 


We strongly support the proposed EU4Health programme. It seeks to assert a 
stronger role for the EU on public health. 


Policy-makers should now realise that investing in digital is a precondition to 
achieve the programme's priority of making Europe’s health systems more 
resilient. Digitalising hospitals — for instance, by moving to a digital 
documentation system and integrating data into it —- enables a systemic approach 
to prevention, treatment and care of cross-border health threats to the Union. 


The EU has a moral duty to make use of existing, well-tested digital technologies 
and build capacity for the Common European Health Data Space. It needs to: 


1. Establish world-reference Al testing facilities. New excellence centres 
across the EU should partner with healthcare actors to test Al solutions in 
real operational environments. This is key for health organisations to 
attract and retain the best talent. 


5 Commission Recommendation (EU) 2019/243 of 6 February 2019 on a European Electronic Health Record exchange format 
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Regulators must also keep in mind that there are strong risk-assessment 
processes in place for Al-based health solutions intended for medical 
purposes such as diagnosis, prevention or treatment of diseases, which 
fall under the scope of the Medical Device Regulation (MDR) 2017/745 
and In Vitro Diagnostic Regulation (IVDR) 2017/746. These regulations 
contain well-defined risk classifications based on the potential risk of 
harm posed by the device.® 


2. Ringfence at least 8-10% of the EU4Health budget to realise the 
Common European Health Data Space. In synergy with the Digital 
Europe Programme (DEP), EU4Health should scale up successful 
Innovative Medicines Initiative (IMI) projects for the secondary use of 
data, like the European Health Data & Evidence Network (EHDEN), and 
boost digital tools and computing capacity to host the data space. This 
should include funding for the development and implementation of 
relevant data exchange profiles, following the examples of the Integrating 
the Healthcare Enterprise (IHE) funds or the Smart Open Services for 
European Patients (EPSOS) initiatives in the past. 


1. Carve out a bigger role for telehealth in EU4Health and new EU 
digital health policies. COVID-19 brought telehealth to the forefront in 
many countries. In France, it surged by 40% in recent weeks.’ This trend 
is here to stay. 


= EU4Health should promote investments for telehealth 
technologies. Telemonitoring of chronic diseases, telecare, virtual 
conference tools and Al chatbots are all examples of how we can 
ease the ever-growing pressure on hospitals and the entire 
healthcare system. The Commission recognises most EU 
countries have an inadequate IT infrastructure to integrate even 
existing telemedicine tools today.® 


= Connecting Europe Facility (CEF) 2.0 Digital should boost 
connectivity in rural areas. In several EU countries, rural areas 
can rely on half or less than half the number of doctors available in 
urban areas per 1000 inhabitants.? Connectivity is critical for 
telehealth to help address doctor shortages in remote 
communities. CEF 2.0 Digital must quickly build infrastructure for 
health in coordination with EU4Health, lest Europe will be stuck in 
the low gear when the next crisis hits. 


6 DIGITALEUROPE’s comments on the European Commission’s Al White Paper elaborate further on this aspect (pg. 27) 


7 Widoobiz (2020). Le coronavirus fait exploser la télémédecine en France 
8 European Commission (2018). Market Study on telemedicine 
9 European Data Journalism Network (2018). Europe has a shortage of doctors 
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= The Commission should also explore more robust coverage, 
payment and reimbursement for telemedicine and 
teleconsultations together with Member States. 


2. Build digital acumen and skills among health professionals. ICT 
specialists are just 1% of healthcare workforce. Up to 70% of health 
professionals do not use digital solutions due to gaps in knowledge and 
skills in data analytics. '° 


= Member States must prepare tomorrow’s healthcare talent with 
digital-ready university curricula. Data science and artificial 
intelligence should be at the centre of a major reform of education 
systems in Europe, supported by the EU. No health system can 
be resilient without digital literacy and the necessary digital skills 
among health professionals. 


= The Commission should deploy Digital Europe Programme (DEP) 


funding for urgent healthcare workforce upskilling. DEP’s Digital 
Innovation Hubs, Al testing facilities and competence centres 


must also appeal to doctors, nurses and other healthcare 
practitioners, not just industry and researchers. These centres 
should partner with healthcare actors to test Al solutions in real 
operational environments. 


3. Introduce an ambitious target for digital health spending in the new 
ReactEU programme and guarantee ERDF funding flows into 
hospital digital upgrade. Spending on software, databases and ICT 
services in health has been comparatively modest for too long in. 
COVID-19 exposed all the digital infrastructure weaknesses of our health 
systems. 


Introducing a target on minimum ReactEU investments on digital 
equipment and tools for hospitals would act an insurance policy against 
the next pandemic outbreak. The Commission must also negotiate 
ambitious ERDF Operational Programmes with national governments and 
guarantee with all its energies that investments for health systems 
resilience are really prioritised. 


100ECD Health Policy Studies (2019). Health in the 21st Century: Putting Data to Work for Stronger Health Systems. 
11 OECD Health Policy Studies (2019). Health in the 21st Century: Putting Data to Work for Stronger Health Systems. 
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About DIGITALEUROPE 


| 
DIGITALEUROPE represents the digital technology industry in Europe. Our members include l 
some of the world’s largest IT, telecoms and consumer electronics companies and national l 
associations from every part of Europe. DIGITALEUROPE wants European businesses and l 
citizens to benefit fully from digital technologies and for Europe to grow, attract and sustain the l 
world’s best digital technology companies. DIGITALEUROPE ensures industry participation in l 
the development and implementation of EU policies. l 

l 
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Corporate Members 


Accenture, Airbus, Amazon, AMD, Apple, Arçelik, Bayer, Bosch, Bose, Bristol-Myers Squibb, Brother, 
Canon, Cisco, DATEV, Dell, Dropbox, Eli Lilly & Company, Epson, Ericsson, Facebook, Fujitsu, Google, 
Graphcore, Hewlett Packard Enterprise, Hitachi, HP Inc., HSBC, Huawei, Intel, Johnson & Johnson, JVC 
Kenwood Group, Konica Minolta, Kyocera, Lenovo, Lexmark, LG Electronics, Mastercard, METRO, 
Microsoft, Mitsubishi Electric Europe, Motorola Solutions, MSD Europe Inc., NEC, Nokia, Nvidia Ltd., Océ, 
Oki, Oracle, Palo Alto Networks, Panasonic Europe, Philips, Qualcomm, Red Hat, Ricoh, Roche, Rockwell 
Automation, Samsung, SAP, SAS, Schneider Electric, Sharp Electronics, Siemens, Siemens Healthineers, 
Sony, Swatch Group, Tata Consultancy Services, Technicolor, Texas Instruments, Toshiba, TP Vision, 
UnitedHealth Group, Visa, VMware, Xerox. 


National Trade Associations 


Austria: IOÖ Germany: BITKOM, ZVEI Slovakia: ITAS 
Belarus: INFOPARK Greece: SEPE Slovenia: GZS 
Belgium: AGORIA Hungary: IVSZ Spain: AMETIC 


Croatia: Croatian 

Chamber of Economy 
Cyprus: CITEA 

Denmark: DI Digital, IT 
BRANCHEN, Dansk Erhverv 
Estonia: ITL 

Finland: TIF 

France: AFNUM, Syntec 
Numérique, Tech in France 


Ireland: Technology Ireland 
Italy: Anitec-Assinform 
Lithuania: INFOBALT 
Luxembourg: APSI 
Netherlands: NLdigital, FIAR 
Norway: Abelia 

Poland: KIGEIT, PIIT, ZIPSEE 
Portugal: AGEFE 

Romania: ANIS, APDETIC 


Sweden: Teknikfêretagen, 
IT&Telekomféretagen 
Switzerland: SWICO 

Turkey: Digital Turkey Platform, 
ECID 

Ukraine: IT UKRAINE 

United Kingdom: techUK 


